topic Re: force UF to reindex remotedly in Getting Data In

force UF to reindex remotedly

ribentrop — Fri, 26 Dec 2014 11:43:53 GMT

Hello!
Our Customers' environment is a large pool of windows/linux servers with logs of many forms.
Sometimes when constructing props or other conf files I strongly need to reindex data. So I want to clean forwarder's fishbacket.
I don't have physical access to servers when forwarders installed no administrative privileges to do it remotely.
The procedure "./splunk stop -clean fishbacket- ./splunk start" is not for me. And I don't want to bother the customer with my "clean fishbacket script"
As far as I know I can use REST API calls to somehow manage forwarders. I exactly can reload UF and it works.
Can I use REST API to force UF to reindex?
Is there any other way to clean fishbacket in my case?
I think my situation is rather typical, so I believe the solution should exist.
Thanks a lot!

Re: force UF to reindex remotedly

martin_mueller — Fri, 26 Dec 2014 17:36:51 GMT

Use offline data indexed into a temporary testing index for build your props.conf, and only enable your forwarders on the real data once you have the settings correct. That way you won't need to frequently clean fishbuckets and reindex stuff.

Re: force UF to reindex remotedly

ribentrop — Sat, 27 Dec 2014 09:39:56 GMT

Uff.... That's the thing I started to do at the begining of my activities. I created TEMP index for test purposes, but then I abandoned it for quicker results.. Hurry is not a good thing.
Thanks a lot!